At install time the list of upstream profiles to disable is not
available, but the disable/ symlinks shipped by the package are. Use
them as source and move the upstream profile aside as <name>.<pkgname>,
like the prebuild Overwrite task does.

SetFlags now takes a list of flags files or *.conf dirs, read in order,
so aa-install can feed it the user config dirs. Flag rewriting moves to
util.ApplyFlags and profiles moved aside by overwrite are resolved as
<profile>.<pkgname>.

Inverse of Ignore: keep only the profiles and groups listed in the
*.conf files of the user config dirs, everything else is removed. When
any include rule is set, this task takes over profile selection from
Install.

Only keep profiles whose attachment resolves to a program present on the
system. Attachments are read from the built profile header, AppArmor
variables are substituted to filesystem globs, and profiles with no
attachment follow their group. Disable symlinks are reconciled with the
profiles actually kept.

The groups/ tree is flattened by the Merge task, so group membership is
saved in the shared task config for the later tasks that need it.

Set a default enforce/complain mode on every profile at install time,
except the profiles a user flags.d drop-in already assigns a mode to.

…d util packages.

…dirs.

…graph.

A paragraph starting with `}` continues the conditional block of the
previous one, its matching `{` is there, so the tokenizer would see
unbalanced braces. Merge them instead.

Install, update and remove the apparmor.d profiles from the source tree
to /etc/apparmor.d. Profile selection, flags and deploy mode come from
the vendor and admin config dirs, and an installed-file manifest is kept
so status, list and uninstall know exactly what was written.

…tall.

…nstall.

debian/apparmor.d.hide is now a static file in the package, so there is no need to write it from prebuild.

…get.

Add pkg/state to detect the system state and manage the state tunable
files.

The overwrite list is now shipped as an overwrite.d config file. The
disable link and the <name>.<pkgname> rename are only applied when the
target ships the upstream profile, in all install modes. Also drop
config-package-dev: the diverted profiles stayed in /etc/apparmor.d and
were still read by the parser.

…or.d